# CISA warns of ATG system attacks

Published: 2026-06-02 · Severity: high · Sectors: energy, infrastructure, transportation
Canonical: https://vorant.io/reports/a8ad371a-0331-48ae-b8b2-7777e9d4c926/cisa-warns-of-atg-system-attacks

> CISA and partners warn of active cyber attacks on internet-exposed automatic tank gauge systems across critical infrastructure sectors, urging immediate removal from public internet.

CISA, FBI, NSA, and five other U.S. government agencies have issued a joint advisory regarding ongoing malicious cyber activity targeting automatic tank gauge (ATG) systems deployed across the Energy, Chemical, Food and Agriculture, and Transportation Systems sectors. ATG systems monitor storage tank parameters including fuel levels, temperature, and leak detection. The U.S. government has not attributed this activity to a specific nation-state or threat actor group.

Threat actors are exploiting internet-exposed ATG systems through multiple vectors including authentication bypass, hardcoded credentials, OS command execution, SQL injection, and privilege escalation. Once compromised, attackers can modify system attributes, alter network settings and pump controls, disable critical alerts, and create denial-of-view conditions that could cause permanent damage to tank systems. The potential for environmental hazards from undetected leaks and relay failures presents significant operational and safety risks.

The authoring agencies recommend ATG owners immediately eliminate public internet exposure of ATG serial ports and web interfaces, implement strong credential management with phishing-resistant MFA where feasible, apply security patches through certified service providers, and actively monitor networks for unauthorized access. Organizations should engage third-party providers to adopt OT-specific security mitigations and report suspicious activity to CISA, FBI, EPA, or DOE through established channels.

## Detection guidance (public sample)

### External Network Connection to ATG Serial-to-Ethernet Service Port (TCP/10001)

ATT&CK: T1190

Detects inbound network connections to TCP port 10001, the well-known serial-to-ethernet gateway port used by automatic tank gauge (ATG) systems, originating from external/untrusted network zones, indicating potential exposure and exploitation of internet-facing ATG interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: External Connection to ATG Gateway Port 10001
id: 18777026-1627-51a5-9d77-c06bb9bfb2ab
status: experimental
description: Detects inbound network connections to TCP/10001, the port commonly used
  by automatic tank gauge (ATG) serial-to-ethernet gateways, from external or untrusted
  network zones. CISA and partner agencies have warned that internet-exposed ATG systems
  on this port are being targeted for authentication bypass, command injection, and
  unauthorized configuration changes.
references:
- https://www.cisa.gov/news-events/alerts
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 10001
  filter_internal:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal
falsepositives:
- Legitimate internal OT/ICS network segments intentionally using port 10001 for authorized
  ATG management traffic
- Third-party service provider maintenance connections that are not properly scoped
  to internal ranges
level: medium
tags:
- attack.t1190
- attack.initial_access
author: Vorant
```

### Security Tool or Firewall Disabled via Command Line Following Remote Access

ATT&CK: T1562.001

Detects command-line attempts to disable firewall, antivirus, or logging services, a behavior consistent with attackers disabling alerts and monitoring after gaining OS command execution on exposed ATG management or HMI systems. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firewall or Security Tool Disabled via Command Line
id: 78e54abc-4f92-59d2-bc27-7568cd81add4
status: experimental
description: Detects commands that disable Windows Firewall, Defender real-time protection,
  or stop security-related services. This matches reported attacker behavior of disabling
  critical alerts and monitoring on compromised ATG or associated HMI/management systems
  after gaining command execution access.
references:
- https://www.cisa.gov/news-events/alerts
logsource:
  category: process_creation
  product: windows
detection:
  selection_netsh:
    Image|endswith: \netsh.exe
    CommandLine|contains|all:
    - advfirewall
    - state off
  selection_defender:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - Set-MpPreference
    - DisableRealtimeMonitoring
  selection_scstop:
    Image|endswith: \sc.exe
    CommandLine|contains|all:
    - stop
    - WinDefend
  condition: 1 of selection_*
falsepositives:
- Authorized IT administrators disabling firewall/defender temporarily for troubleshooting
  or software installation
- Endpoint management tools that legitimately reconfigure security settings during
  deployment
level: high
tags:
- attack.t1562.001
- attack.defense_evasion
author: Vorant
```

### Local Account Creation or Privilege Escalation Following Remote Logon

ATT&CK: T1098

Detects creation of a new local user or addition of an account to the local administrators group shortly after interactive or remote logon, matching reported attacker behavior of account manipulation and privilege escalation on compromised ATG-connected management systems. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Local User Creation or Admin Group Modification via Command Line
id: 711d996b-d746-5b87-8e18-94b9b591f9ce
status: experimental
description: Detects use of net.exe or net1.exe to create a new local user account
  or add an account to the local Administrators group, consistent with reported account
  manipulation and privilege escalation activity following unauthorized remote access
  to exposed ATG management or HMI systems.
references:
- https://www.cisa.gov/news-events/alerts
logsource:
  category: process_creation
  product: windows
detection:
  selection_useradd:
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains|all:
    - user
    - /add
  selection_groupadd:
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains|all:
    - localgroup
    - administrators
    - /add
  condition: 1 of selection_*
falsepositives:
- Legitimate IT helpdesk or provisioning scripts creating accounts or assigning administrative
  rights
- Automated configuration management tools (e.g., Group Policy, SCCM) performing account
  provisioning
level: medium
tags:
- attack.t1098
- attack.persistence
- attack.t1078
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/resources-tools/resources/cisa-and-partners-urge-hardening-automatic-tank-gauge-systems

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a8ad371a-0331-48ae-b8b2-7777e9d4c926/cisa-warns-of-atg-system-attacks.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup